Cyber Risk Management Flashcards

Question 1

What is cyber risk in the context of risk management?

Accepted Answer

Cyber risk is the potential for loss or harm to an organization from failures or misuse of its digital systems, data, or technology. It is usually expressed as a combination of how likely an adverse event is and how severe its consequences would be.

Question 2

How is risk commonly calculated in basic risk management?

Accepted Answer

A common simplified model multiplies likelihood by impact, so risk equals the chance that an event occurs multiplied by the harm it would cause. Qualitative scales such as low, medium, and high often replace exact numbers. The result helps teams rank risks and decide where to focus limited time and money first.

Question 3

What is the difference between a threat and a vulnerability?

Accepted Answer

A threat is any actor or circumstance with the potential to cause harm, such as a malicious attacker or malware. A vulnerability is a weakness in a system, process, or control that a threat could exploit. Risk arises when a threat meets a vulnerability.

Question 4

What does the CIA triad represent in information security?

Accepted Answer

The CIA triad is a model of three security objectives: confidentiality, integrity, and availability. Confidentiality means information is accessible only to authorized people. Integrity means data remains accurate and unaltered except by authorized changes. Availability means systems and data are accessible when needed. Risk management examines how each objective could be harmed.

Question 5

What is the difference between inherent risk and residual risk?

Accepted Answer

Inherent risk is the level of risk that exists before any controls are applied to address it. Residual risk is the risk that remains after controls have been implemented. Comparing the two shows how much a control reduces exposure. Organizations accept residual risk only when it falls within their stated risk appetite.

Question 6

What does risk appetite mean for an organization's decisions?

Accepted Answer

Risk appetite is the amount and type of risk an organization is willing to pursue or accept in pursuit of its objectives. It is set by leadership and reflects business goals, legal duties, and tolerance for disruption. Risk tolerance is a related idea that describes acceptable variation around specific targets.

Question 7

Why is asset identification the first step in cyber risk management?

Accepted Answer

Asset identification comes first because risks only matter in relation to something of value. Organizations list hardware, software, data, personnel, and services, then note where each is stored and who depends on it. Without an inventory, teams cannot judge which threats matter most or where controls should go.

Question 8

What information does a risk register contain, and why is it kept?

Accepted Answer

A risk register is a structured record of identified risks, usually stored in a spreadsheet or governance tool. Each entry typically includes a description, an owner, a likelihood and impact rating, current controls, and planned actions. Maintaining the register gives leaders a shared view of exposure.

Question 9

What are the common categories of cyber threat actors?

Accepted Answer

Common threat actor categories include criminal groups seeking financial gain, nation-state actors pursuing espionage or disruption, hacktivists motivated by causes, and insiders who misuse legitimate access. Some actors are opportunistic, while others are highly organized and patient. Understanding who might attack helps teams tailor defenses to likely motivations and methods.

Question 10

What is a threat vector and how do attackers use one?

Accepted Answer

A threat vector is the path or method an attacker uses to reach and compromise a target. Common vectors include phishing emails, exposed remote access services, compromised software updates, removable media, and weak credentials. Identifying likely vectors helps defenders place controls where attackers are most likely to enter.

Question 11

What is a vulnerability scan and what does it reveal?

Accepted Answer

A vulnerability scan is an automated check of systems, networks, or applications to identify known weaknesses such as missing patches, misconfigurations, or outdated software versions. The output is a list of findings, often with severity ratings. Scans show what might be exploited but do not confirm an attack or measure business impact.

Question 12

What is an exploit, and how does it differ from a vulnerability?

Accepted Answer

An exploit is a piece of code, technique, or sequence of actions that takes advantage of a vulnerability to cause unintended behavior. The vulnerability is the weakness itself, while the exploit is the means of using it. A vulnerability can exist for a long time without being exploited.

Question 13

What is the difference between likelihood and impact in risk analysis?

Accepted Answer

Likelihood is the estimated probability or frequency that a threat will successfully exploit a vulnerability within a given period. Impact is the magnitude of harm if that event occurs, measured in financial loss, safety effects, legal exposure, or reputational damage. Analysts assess both before combining them into a risk rating.

Question 14

Why does a single incident often have multiple impacts?

Accepted Answer

A single cyber incident can affect several areas at once because systems and data are connected. A ransomware attack, for example, may halt operations, expose personal information, trigger regulatory reporting, and damage customer trust. Analysts therefore consider financial, operational, legal, safety, and reputational impacts together rather than focusing on just one category.

Question 15

What does the term attack surface mean in cyber risk work?

Accepted Answer

An attack surface is the total set of points where an unauthorized user could attempt to enter or extract data from a system. It includes network services, web applications, user accounts, APIs, physical access points, and employees who can be targeted. Removing unnecessary services and access lowers exposure.

Question 16

What role does threat intelligence play in risk assessment?

Accepted Answer

Threat intelligence is information about current adversaries, their tactics, and their indicators of compromise, gathered from sources such as incident reports and industry sharing groups. It helps analysts judge which threats are active and which vulnerabilities are being targeted. Using it keeps risk assessments grounded in real attacker behavior rather than guesswork.

Question 17

What is the difference between qualitative and quantitative risk analysis?

Accepted Answer

Qualitative analysis describes risks using categories such as low, medium, and high, based on expert judgment. Quantitative analysis assigns numeric values, such as estimated annual loss in currency, using data and models. Qualitative methods are faster and easier to start with, while quantitative methods support more precise cost-benefit decisions.

Question 18

What is a risk matrix and how is it used?

Accepted Answer

A risk matrix is a grid that plots likelihood against impact, usually with colored zones marking low, medium, and high priority risks. Each identified risk is placed in a cell based on its ratings. The matrix helps leaders compare risks quickly and decide which need immediate attention.

Question 19

What is a risk assessment, and what are its main stages?

Accepted Answer

A risk assessment is a structured process for identifying, analyzing, and evaluating risks so that decisions can be made about them. Its main stages are identifying assets, threats, and vulnerabilities, analyzing likelihood and impact, and evaluating results against risk criteria. Good assessments are repeatable, documented, and tied to business objectives.

Question 20

What does a risk treatment plan contain and who approves it?

Accepted Answer

A risk treatment plan lists the actions chosen for each significant risk, along with responsible owners, deadlines, and expected outcomes. It records whether each risk will be reduced, avoided, transferred, or accepted. Plans should be approved by appropriate leaders and tracked until actions are complete and residual risk is confirmed.

Question 21

What does a business impact analysis tell an organization about its operations?

Accepted Answer

A business impact analysis identifies critical business functions and estimates how disruption to them would affect the organization over time. It defines recovery time objectives, which set how quickly a function must be restored, and recovery point objectives, which set how much data loss is tolerable. Its results guide continuity and recovery planning.

Question 22

What is a threat model and when is it most useful?

Accepted Answer

A threat model is a structured way to find what could go wrong in a system by examining its components and data flows. Teams ask what they are building, what can go wrong, and what they will do about it. Threat modeling is most useful early in design, when changes are cheapest.

Question 23

What is the purpose of a control effectiveness assessment?

Accepted Answer

A control effectiveness assessment checks whether a safeguard is designed properly and actually operating as intended. Design testing asks whether the control would address the risk if it worked, while operating testing checks evidence that it works consistently over time. Results show how much residual risk remains and where improvements are needed.

Question 24

Why are assumptions important when performing a risk assessment?

Accepted Answer

Assumptions shape every rating, so unstated or unexamined assumptions can quietly distort results. Typical assumptions concern attacker capability, the reliability of controls, data accuracy, and how long an outage would last. Recording assumptions explicitly allows reviewers to challenge them and update the assessment when conditions change.

Question 25

What are the four common risk treatment options?

Accepted Answer

The four common options are to avoid, reduce, transfer, and accept a risk. Avoiding means changing plans so the risk no longer arises. Reducing means applying controls to lower likelihood or impact. Transferring shifts some financial burden to another party, such as through insurance. Accepting means knowingly retaining the risk within appetite.

Question 26

What is a security control, and how do controls differ by type?

Accepted Answer

A security control is a safeguard or countermeasure that reduces risk by preventing, detecting, or responding to harmful events. Preventive controls stop an event from happening, such as access restrictions. Detective controls reveal events as they occur or afterward, such as log monitoring. Corrective controls restore operations after an incident, such as restoring from backups.

Question 27

What is defense in depth and why does it reduce risk?

Accepted Answer

Defense in depth is a strategy of layering multiple, independent safeguards so that if one fails, others still provide protection. Layers might include network segmentation, endpoint protection, strong authentication, encryption, and staff training. Layering reduces the chance that one failure leads to a major breach.

Question 28

What is the principle of least privilege and how does it limit harm?

Accepted Answer

Least privilege means giving users, programs, and processes only the minimum access needed to perform their legitimate functions. It limits how far an attacker can move if they compromise one account. Access should be reviewed, and temporary elevated rights should be removed when a task ends. This principle reduces accidental damage and malicious misuse.

Question 29

How does cyber insurance fit into risk transfer?

Accepted Answer

Cyber insurance is a policy that can transfer some financial losses, such as breach response costs, to an insurer. It does not transfer reputational harm, legal obligations to customers, or the duty to protect data. Coverage is limited by policy terms, exclusions, and limits, so insurance complements rather than replaces controls.

Question 30

What is multifactor authentication and why does it matter?

Accepted Answer

Multifactor authentication requires a user to present two or more different types of evidence, such as a password plus a code from a trusted device. It matters because stolen passwords alone are often insufficient to gain access. Strong multifactor methods significantly reduce the risk of account takeover.

Question 31

What is patch management in a risk context?

Accepted Answer

Patch management is the process of identifying, testing, deploying, and verifying software updates that fix known vulnerabilities. In a risk context, it reduces the likelihood that a known weakness will be exploited. Priorities usually reflect severity, exposure of the affected system, and whether exploits are known to exist.

Question 32

What is network segmentation and how does it limit risk?

Accepted Answer

Network segmentation divides a network into separate zones with controlled communication between them. It limits risk by containing an intrusion so an attacker cannot easily move from a compromised device to sensitive systems. Segments can separate guest Wi-Fi, production servers, and administrative networks. Firewalls and access rules enforce the boundaries between segments.

Question 33

What are key risk indicators and what makes them useful?

Accepted Answer

Key risk indicators are measurable signals that show whether a risk is increasing or decreasing over time. Examples include the number of unpatched critical systems, failed login attempts, or the percentage of staff completing security training. Good indicators are tied to specific risks, have clear thresholds, and trigger action when limits are crossed.

Question 34

What is continuous monitoring in cyber risk management?

Accepted Answer

Continuous monitoring is the ongoing collection and analysis of security data to detect changes, weaknesses, and events as they occur. It supports risk management by keeping assessments current rather than limiting them to periodic snapshots. Monitoring draws on logs, scan results, alerts, and asset inventories. Findings feed back into risk registers and treatment plans.

Question 35

How does a cybersecurity incident response plan relate to risk management?

Accepted Answer

An incident response plan defines how an organization detects, contains, eradicates, recovers from, and learns from security incidents. It relates to risk management because it is a control that reduces the impact of events that cannot be fully prevented. Scenarios from risk assessments should inform response playbooks. Lessons from incidents should update risk ratings.

Question 36

What is the role of senior leadership in cyber risk governance?

Accepted Answer

Senior leadership sets risk appetite, assigns accountability, and approves resources needed to manage cyber risk. Executives and board members should understand the organization's most significant exposures and the decisions required of them. Governance structures define who owns each risk and how issues are escalated. Accountability cannot be delegated entirely to technical staff.

Question 37

How should cyber risk be communicated to nontechnical audiences?

Accepted Answer

Communicate risk in business terms, focusing on what could happen, how likely it is, what it would cost or disrupt, and what decision is needed. Avoid jargon and replace technical details with plain language and simple comparisons. Use consistent rating scales so trends are easy to track.

Question 38

What is a cyber risk dashboard and what should it show?

Accepted Answer

A cyber risk dashboard is a visual summary of key risks, indicators, and trends, designed for regular review by management. It should show top risks, their current ratings, changes since the last review, and the status of treatment actions. Good dashboards avoid overwhelming detail and link each figure to a clear decision or owner.

Question 39

Why is risk reassessment necessary after major changes?

Accepted Answer

Risk changes whenever systems, data, threats, or business activities change, so assessments can become outdated quickly. Reassessment after events such as a new cloud service, a merger, or a significant breach keeps ratings accurate. It also confirms whether treatment actions reduced residual risk as intended. Scheduled reviews catch slow drift.

Question 40

What is a risk-based approach to security spending?

Accepted Answer

A risk-based approach directs security investment toward the risks that matter most, rather than applying equal effort everywhere. It uses assessments of likelihood, impact, and existing controls to rank priorities. This allows limited budgets to address the largest exposures first. The approach also requires revisiting priorities as the threat landscape evolves.

Cyber Risk Management Flashcards

1Core Risk Concepts

2Threats, Vulnerabilities and Impact

3Risk Assessment Methods

4Risk Treatment and Controls

5Monitoring, Communication and Governance

Learning Resources